CVE-2026-62993

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2

Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the {fetch} handling within libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php. When a security policy is active, the system uses Security::isTrustedUri() to validate only the initial remote URL against the trusted uri allowlist. Because PHP follows HTTP redirects by default for resources handled by file get contents(), an attacker who can influence the fetch target and leverage an open redirect on a trusted host can redirect the request to an internal endpoint. This allows the attacker to bypass the allowlist and perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location.

Recommendations Update to version 4.5.7 or later. Update to version 5.8.2 or later.